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Annotation. The study is devoted to the formation of an intelligent model for choosing and applying the optimal 
strategy for managing risk events, both threats and opportunities, of modern small IT projects with limited resources and 
implicit or uncertain influencing factors. The proposed model is built taking into account the decomposition of the process 
into three sub-processes, for which the criteria, target function, graphs of the development of events are proposed, taking 
into account the synergy of possible threats and opportunities. It is formed for the purpose of proactive management of 
risk events and is able to overcome uncertainty due to possible forecasting of future states for cases of a priori uncertainty 
and lack of information about possible consequences. The distribution of threats and opportunities is applied in the form 
of a developed unique target model with introduced weights of threats and opportunities based on expert assessments, 
taking into account the experience of experts from previous typical projects. Theoretical recommendations and risk 
management standards from the most common project management standards are taken into account. The developed 
intellectual model takes into account both the cost of implementing strategies and the total costs of their implementation. 


Keywords: intelligent model, risk management, risk, treat, opportunity, risk response, IT-project, decision- 
making methods. 


Introduction not taking risks into account, or not using 

The development of information opportunities, since there are no methods and 
technologies and the use of artificial approaches that would allow it to be done with 
intelligence methods to solve a wide range of a sufficient degree of reliability. Therefore, the 
human activity problems have significantly creation of decision-making methods that are 
improved the quality of life and labor related to risk management, both as threats to 
productivity. activity and as opportunities for development, 

Despite the fact that the effectiveness of are extremely important for practice and an 
solutions to most information processing tasks, interesting object of research for science. 
such as pattern recognition, feature Considering this, there is an urgent need for the 
classification, is increasing, and artificial development of artificial intelligence methods, 
intelligence is successfully used to find which, together with high speed and accuracy 
solutions, there are still tasks that are left to the of calculations, would allow to quickly assess 
decision-maker, typically as to the project the situation, would be able to respond to 
manager. This applies to tasks in which there changes in the surrounding environment, 
is a large a priori uncertainty and no would allow to distinguish the main and 
information about possible consequences. The discard the secondary, to correlate assessments 
class of such tasks can include forecasting in that contain contradictions capable of 
conditions of incomplete data, risk overcoming uncertainty due to the possible 
management, design processes that are prediction of any future states [1]. 


associated with the development of 
fundamentally new samples and that do not use 
design patterns and templates. But as practice 
shows, for most human decisions it is also 
impossible to accurately determine or evaluate 
the consequences. We can only assume that 
certain solutions will lead to the best result. It 
is also difficult to predict the consequences of 


Statement of the problem 

The proposed study is devoted to risk 
management in IT projects. As it turned out, 
for small IT projects, when developing 
fundamentally new software products, it is 
very difficult to find statistical regularities in 
determining risks and assessing their possible 
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consequences. Existing risk classification 
methods and risk management strategies are 
based on the assumption that all risks are only 
threats, and management strategies are based 
on the principle of responding to a risk that has 
already occurred. CMMI for Development is 
an integrated set of best practices that improve 
productivity and key capabilities for 
organizations that develop products, 
components, and services [2]. This model 
contains a risk management domain, which is 
defined as an one of the extended project 
management domains. Any components of the 
risk management area in CMMI for 
Development do not cover opportunity 
management and are dedicated only to 
preparing the organization for negative risks 
only that is called threats [3]. The Japanese 
standard Guidebook of Project and Program 
Management for Enterprise Innovation (P2M) 
describes risk management from a domain 
management perspective. Domain 
management is the management of specific 
functions or areas of project management 
knowledge. According to the P2M standard, 
the implementation of risk management in 
projects leads to the control of many risk 
events and can lead to the realization of an 
opportunity that provides better results and 
development [4]. It can be seen _ that 
Opportunity Management is poorly 
represented from the point of view of the P2M 
standard, while the emphasis is mainly on the 
prediction of negative risks, their control and 
preventive measures or actions [5]. For risk 
management in IT projects, methods of 
predicting the occurrence of risk are very 
poorly involved, therefore there are no 
adequate response strategies, there are also 
completely no strategies that are built on the 
principles of opportunity management 
development. 

This study examines IT projects in which 
it is difficult to determine the probability of 
risk occurrence and there is no information 
about the consequences that may arise from the 
implementation of risky opportunities. 

The main research questions in this 
direction include: 

1. Creation of risk identification methods 
for both threats and opportunities. 
Determination of classification features and 
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assignment of a risk event to the appropriate 
category. 

2. Quantitative and qualitative risk 
analysis with determination of the degree of 
influence. Determination of the criteria by 
which the analysis of the risk event is carried 
out. Determination of criteria for mutual 
influence (synergy) of risk events. 

3. Bringing risk assessment criteria to a 
single measurement scale. 

4. Determination of the purpose of risk 
management, which will allow formulating 
behavioral strategies for risk management. 
Determination of possible scenarios of 
response to a risk event in accordance with the 
management goal. 

5. Selection of the optimal behavior 
strategy for leveling the impact of a threat or 
development of an opportunity. 


Analysis of recent research and 
publications 

The modern market of software and 
intelligent models is characterized by large 
standardized management solutions for fairly 
big typical projects. One of the titans of project 
management software is MS Project, but it 
should be considered the recently developed 
Microsoft Dynamics Project Operations 
system, which includes a more modern and 
broader set of modules and offers the visibility, 
collaboration and flexibility needed to succeed 
in a project-based business. — from potential 
customers to payments and profits [6]. Of 
course, such giants of project and business 


management systems require support, 
financing and the development of the 
necessary additional elements. Another 
software leader, Oracle, also has a 


Construction Project Management product that 
connects and synchronizes teams throughout 
the project lifecycle through planning, project 
management and collaboration, improving 
coordination and control to improve efficiency 
and limit risk across all range of activities [7]. 
A lot of research and development is done in 
the scientific sector, where the development of 
intelligent systems aims to manage narrow 
links and types of projects [8], [9], [10]. 


The aim of the study 
The increase in the cost of IT projects 
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encourages the transition to proactive 
management of a risk event, which is 
implemented by a strategy based on _ the 
assessment of risks, assigning them to the class 


the project environment precisely in the field 
of existing resources, see Figure 1, and the 
optimal use of resources is the basic criterion 
for optimizing the management strategy [11]. 


of threats or opportunities. At the stage of 
strategy implementation, each strategy is 
accompanied by costs of available resources. 
Therefore, the task of balancing the benefit 
from realizing the opportunity and the costs 
from the threat with limited available resources 
can be considered as an optimization task. 

The purpose of this study is to construct 
such an intelligent optimization model that 
would allow for the selection of the optimal 
risk management strategy, both threats and 
opportunities, with limited available resources, Project 
and would ensure proactive management of 
risk events. The components of the risk event 
management process in the project depend on 


Success 


Threats 


Time 


Fig. 1. Components of the risk management process 
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Fig. 2. Scheme of the components of the intelligent model for choosing the optimal strategy 
for managing risk event 
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Presentation of the main material 

The process of building the optimization 
model can be divided into three sub-processes, 
each of which can be implemented by a 
separate module of the intelligent 
recommender system. These sub-processes 
consist in the assessment of the risk event, the 
selection of optimization criteria and the 
construction of possible scenarios, the 
selection of the optimal behavior scenario. 

The diagram of the model components 
and the interaction between them is shown in 
Figure 2. 

Analyzing each of the processes: 

1) Risk event assessment. At this stage, 
risk identification is performed, the qualitative 
characteristics of the risk event are determined, 
the event is classified as a threat or opportunity 
based on these characteristics, the quantitative 
characteristics of the risk event are determined, 
the mutual impact of events (synergy) on the 
development of the project is determined, and 
the impact criteria are normalized. 

2) Construction of the target function and 
possible scenarios of the development of 
events. 

A Bayesian graph of the possible 
development of the project (scenario) is built 
based on historical information for similar 
events in similar projects, and information 
about available assets and resources. A set of 
alternative project development scenarios is 
being formed. The criterion of optimality is 
determined, namely, the benefit from the 
realization of the opportunity and the amount 
of possible losses in the event of a threat are 
calculated. 

3) Selection of the optimal risk event 
management strategy. An _ optimization 
algorithm is implemented, the optimal solution 
for the objective function is found with the 
help of intelligent algorithms, thus the optimal 
response scenario to a risk event is determined 
[12]. Taking into account the complex nature 
of risks, both threats and opportunities, and 
using a target models approach, each risk, 
whether a threat or an opportunity, should be 
ranked and placed in the target model for each 
project constraint to calculate the overall risk 
for each project constraint and make a decision 
on choosing the optimal strategy. 
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The complex nature of threats and 
opportunities can be represented by the 
following formulas 


D; = Ya Pia * (Vian + Viae + Vias + Viaq)» 


C; = Diet Pic * View + Vict + Vics + Vicq)s 


where i—a value from 1 to n or m, n — number 
of threats in the project, D; — 1-th threat in the 
project, P,, — probability of occurrence of the 1- 
th threat from 0 to 1, V;g, — an impact value of 
the i-th threat on the budget from -10 qo 0, Vigr 
— an impact value of the i-th threat on time or 
schedule from -10 to 0, V;z,— an impact value 
of the i-th threat on project scope from -10 to 
O, Viag — an impact value of the i-i threat on 
quality from -10 to 0; m — number of 
opportunities in the project, C; — i-th 
opportunity in the project, P,,— probability of 
occurrence of the i-th opportunity from 0 to 1, 
Vicp — an impact value of the 1-th opportunity on 
the budget from 0 to 10, V;,,, — a value of the i- 
th impact of the opportunity on the time or 
schedule from 0 to 10, V;., — a value of the i-th 
opportunity value on project scope from 0 to 
10, Vicg— a value of the i-th opportunity impact 
on project quality from 0 to 10. All Pig, Pic, 
Viap» Viat, Vids, Viaq Vich, Vict, Vics, Vicg val 
ues for threats and opportunities are 
determined using experts assessments [13]. 

The relative synergistic effect can be 
represented in the form of the ratio of the 
difference between the indicators of income 
and the planned budget with the total grouped 
threat and opportunity of the project and the 
difference between income and the planned 
budget with the sum of all j-th threats and i-th 
opportunities of the project. Which is modeled 
by the following expression: 


= F-S—(Yfhg Lito (Ltz=0P jt? jt-Lia=0 DitVit)) >1 
F-S-Y} <0 Lixo PjtV jt+Dii=0 Yeo PitVit : 
where F is the expected revenue from the 
project and S is the project budget. The 
presented condition model is a_ positive 
synergistic effect from managing threats and 
opportunities at the same time, because the 
total result from managing risks and threats is 
higher than from managing threats or risks 
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separately. This hypothesis can be tested on the 
model of grouping of threats and opportunities 
depending on various features [14]. 

A Bayesian graph is constructed to 
determine possible strategies for the 
development of a risk event. The Bayesian 
graph of the development of events (scenario) 
in its general form is a directed acyclic graph, 
which can be defined as: 


BAG = (S,E,A,P), 


Where S = {5S,,5Sp,...,5,}— the set of 
nodes of all attributes of the graph. 

E = Lise gunate} — the set of all 
directed edges of a graph where E;; has two 
terminal nodes E; and E£;, with S; being the 
parent node and S; being the child node. 

A = {A,,A),...,4,} determines 
alternatives for the development of events. 
A, =1 means that the alternative exists, 
otherwise A; = 0. 

P = {P(S,), P(S2),...,P (S,)} is the set 
of probabilities that a risk event may occur at a 
given stage. P(S;) determines the probability 
of success in passing the risk event of the 
attribute node S;. 

Information about available assets and 
resources is plotted on the Bayesian graph, 
which allows determining the criterion of 
optimality. The criterion of optimality is 
additive and characterizes the benefit from 
realizing the opportunity and the amount of 
possible losses in the event of a threat. 

Calculation of the probability of 
occurrence of a risky event 


PUSS eo 


that takes place taking into account the 
indicators V — speed of impact (the impact of a 
risk event on a short period of time of the 
project), C — complexity (characterizes the 
level of complexity of the consequences of the 
impact), U — authentication of the risk event as 
a threat or opportunity, their values are shown 
in table 1. 

A is a set of alternative scenarios of the 
development of events, denoted as A = 
{A,,Az,...,4,}, where A; is each individual 
scenario of the development of events that can 
be implemented on the attribute node S;. A; = 
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1 means that the strategy will be implemented, 
otherwise A; = 0. 


Table 1. Identifiers 


Identifier Level Value 

high 1 

4 medium 0,5 
low 0) 
high 1 

C medium 0,5 
low 0 

threat 1/0 

U 
opportunity 1/0 


Implementation of strategies inevitably 
incurs costs to prevent threats and/or realize 
opportunities. 

The cost can be determined by a set [15] 

COST = {COST,, COST>,..., COST}, 
where COST; is the cost of implementing 
strategy A;. The cost of each alternative can be 
defined as 


COST; = @; X value X 100, 


where @, is the normalized weight of the 
strategy, its value is measured by the value of 
the asset. Thus, the total costs of 
implementing strategies A = {A,,Ag,... 
can be determined by the formula: 


An} 


C(A) = SA,COST,, nei = 1. 


The benefit of implementing the S; 
attribute capability can be defined as 


AG(S;) = P(S;) X value. 

In addition, the advantage of the attribute 
in the implementation of the strategy 
alternative can be defined as 


AG(S;|A) = P(S;|A) X value. 


Thus, the implementation of all possible 
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strategies for providing opportunities [16] 
AG(M) = 1 S;e S AG(S;|M). 


Since, in small IT projects, losses from 
threats can significantly outweigh benefits 
from opportunities, and their joint 
implementation can cause competition in the 
use of resources, it is advisable to use a 
cautious approach and use resources sparingly. 
Thus, we propose to minimize both the benefit 
from opportunities and the cost of expenses in 
case of threats [17]. 

The objective function can be defined 


cin, OAG(A) + (1 -—6)C(A)), 


where 6 and 1-6 are the weighting 
coefficients of the benefit advantage of the 
opportunity and the cost of preventing the 
threat, respectively, and 0 <6 <1 is the 
limit of the total cost. 


Conclusions 

It is proposed to consider the 
management of risk events for small IT 
projects as an optimization model that allows 
you to choose the optimal risk management 
strategy, for both threats and opportunities, 
taking into account their synergistic effect, 
benefits from opportunities and minimizing the 
costs of threats, and limited available resources 
in the project. The developed intelligent model 
takes into account the complex nature of threat 
and opportunity, which affects the main 
constraints of the project, which leads to 
proactive and effective project management. 
Using the proposed approach will allow 
dynamic management of non-typical small- 
scale IT projects that are not provided with 
adequate support when using standard project 
management software from world leaders. 

The intelligent model provides 
decomposition of the process into three sub- 
processes, it takes into account the graphs of 
the development of events, the synergy of 
possible threats and opportunities. The choice 
of the optimal solution is ensured by cost 
optimization, for which the criteria and the 
objective function are proposed. The 
distribution of threats and opportunities is 
applied in the form of a developed target model 
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with entered weights of threats and 
opportunities based on expert assessments. 
Both the cost of implementation of strategies 
and the total costs of their implementation are 
taken into account, a careful approach to the 
economical use of resources is used, which 
allows balancing the benefit from the winning 
of the opportunity and the reduction of costs 
from the threat with limited available 
resources. 
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